CVE-2026-45872

scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

State: Published
Severity: Not scored
Published: May 27, 2026
Updated: May 27, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic, leading to memory leaks.

Consolidate the error handling by adding an out_free_rpl_list label and use goto statements to ensure rpl_list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	28ca6d876c5a375094847606046e0bf5d044d9b4 to before f471ecfec093e39ef8fd08978413793087daa14dAffected 28ca6d876c5a375094847606046e0bf5d044d9b4 to before fdf1188cfa80f88c9f18d58cb33d57ff40e70e26Affected 28ca6d876c5a375094847606046e0bf5d044d9b4 to before d52e13122d3771f753dd73ae6512fa01f58015cbAffected 28ca6d876c5a375094847606046e0bf5d044d9b4 to before e5579ebaadc7b699868dad0f591a7bf83cd647e1Affected 28ca6d876c5a375094847606046e0bf5d044d9b4 to before 454570434114e4862767f506a442a0f110b639b2Affected 28ca6d876c5a375094847606046e0bf5d044d9b4 to before 41b37312bd9722af77ec7817ccf22d7a4880c289Affected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

28ca6d876c5a375094847606046e0bf5d044d9b4 to before f471ecfec093e39ef8fd08978413793087daa14dAffected
28ca6d876c5a375094847606046e0bf5d044d9b4 to before fdf1188cfa80f88c9f18d58cb33d57ff40e70e26Affected
28ca6d876c5a375094847606046e0bf5d044d9b4 to before d52e13122d3771f753dd73ae6512fa01f58015cbAffected
28ca6d876c5a375094847606046e0bf5d044d9b4 to before e5579ebaadc7b699868dad0f591a7bf83cd647e1Affected
28ca6d876c5a375094847606046e0bf5d044d9b4 to before 454570434114e4862767f506a442a0f110b639b2Affected
28ca6d876c5a375094847606046e0bf5d044d9b4 to before 41b37312bd9722af77ec7817ccf22d7a4880c289Affected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.